By Kara Nuzback

Getting certified to prescribe controlled substances electronically is not easy, but it’s worth the trouble, says pain medicine specialist Cheryl White, MD.

Like many physicians, White wrote controlled substance prescriptions from her prescription pad for her patients at Brazos Pain Consultants in Sugar Land, Texas. But in March, a pharmacist notified her of a patient trying to obtain a controlled substance using her name and credentials. When the pharmacist noticed the phone number and address provided by the patient did not match White’s Texas Department of Public Safety profile, he called White to confirm the prescription and faxed her a copy of the paper document.

White says the prescription was fake; someone had manufactured a prescription pad using her name and credentials, including her medical license number, her Drug Enforcement Administration certification number, and her DPS identification number, coupled with a fake address and a phone number she later discovered linked to a prepaid, disposable phone.

In October 2013, DPS officially began allowing physicians to electronically prescribe schedule II controlled substances, such as Adderall, Ritalin, morphine, methadone, Oxycontin, Percocet, and now hydrocodone. The practice of electronic prescription of controlled substances for schedule II drugs became more commonplace in March 2014, after DPS completed a small pilot program to test the accuracy of reporting schedule II drugs to the Texas Prescription Program.

Sending prescription requests to a pharmacy through an electronic vendor helps reduce the risk of prescription fraud. But doctors who are using EPCS have encountered some challenges, including pharmacies not certified to accept the electronic requests.

Prescription fraud is a type of medical identity theft in which the perpetrator lifts a physician’s credentials from a prescription pad and uses them to obtain drugs illegally. Even if a pharmacist tries to confirm the prescription, the number provided on the forged document often connects him or her with the perpetrator, who poses as the physician in question and gives the pharmacist permission to fill the prescription.

“So simple it’s elegant,” White says. “These people are hijacking my credentials, manufacturing prescription pads, and going to town. The way we currently write paper prescriptions is tantamount to leaving blank checks all over town.”

As of May 2014, White says about 75 people across Texas had filled prescriptions illegally using her name. Worst of all, White says, she can’t make it stop. If she applied for new DEA and DPS numbers, the time it would take to obtain them would interrupt patient care. According to the DEA Office of Diversion Control, a new DEA application can take four to six weeks to process.

“I have cancer patients and cannot potentially suspend their treatment for several weeks,” she says.

Although White works to help her patients manage pain, her predicament is not unique to her specialty. She says any physician who prescribes a controlled substance, such as an obstetrician-gynecologist prescribing hydrocodone after a cesarean section, is at risk.

The solution, she says, is for doctors to embrace EPCS.

“If I’m going to prescribe controlled substances, I’d rather do it through a clearinghouse,” White says.

A growing problem

White says she reported her case of prescription fraud to local police and sheriff’s departments, DEA, the Texas Legislature, and DPS. She has also informed the Texas Medical Board and the Texas State Board of Pharmacy about her predicament to avoid being blamed for violating the law.

“I’ve had a hell of a time getting law enforcement to give me any support. I’m not sure if it’s lack of knowledge on the part of law enforcement, lack of funding, or lack of interest,” she says. “It’s been expensive, it’s been very time-consuming, and it’s been frustrating.”

White says because people are using her information to cash in faulty prescriptions all over the state, the case involves multiple police jurisdictions, and, she says, the local departments do not collaborate well.

In addition, the perpetrators are hard to pin down, she says. The fake patient could claim he or she didn’t know it wasn’t White who provided the prescription, or the perpetrator could use a fake identity at the pharmacy, she says.

“These investigations are painstakingly slow,” she says. “And the criminals are always getting smarter.”

White personally called about 20 pharmacies in the Houston area to warn them against filling a prescription with her name on it that doesn’t match her actual phone number and office address.

“Through speaking with pharmacists and various sources in law enforcement, I’ve found that at least 25 to 30 physicians in the Houston area have had the same thing happen to them. I suspect there are many more who don’t even know that it’s happened to them because they never dreamed they might be vulnerable,” she says.

Physicians who suspect prescription fraud should notify DPS by calling (512) 424-7293 or e-mailing RSD_CES_Criminal@dps.texas.gov.

White says if you have the credentials to write a prescription for a controlled substance, you must safeguard those credentials.

“Generally, the pharmacists try to do the right thing,” she says. “But identity theft is so easy, and I’ve seen this problem becoming bigger every week.”

An invasive procedure

DEA legalized EPCS nationally in 2010. The process for a doctor to become certified for EPCS is arduous and intrusive, says C.M. Schade, MD, who specializes in pain medicine in Mesquite. Schade is a member of the Texas Medical Association Interspecialty Society Committee.

As a leader in pain medicine, Schade says he is participating in EPCS to help guide fellow physicians through the process. “At this point, it [the process] doesn’t work very well.”

First, Schade says, he had to purchase e-prescribing software from an EPCS-certified vendor. Purchasing and installing the software and completing training on how to use it took about a month.

According to the U.S. Department of Health and Human Services Health Resources and Services Administration, the stand-alone cost of an e-prescribing application can cost a physician up to $2,500 a year. However, a free e-prescribing application is available through the National ePrescribing Patient Safety Initiative.

Next, Schade says his software vendor, DrFirst, had to verify his identity. Physicians’ e-prescribing vendors typically use a third-party authentication service that requires physicians to provide detailed personal information, including credit reports, to confirm the physicians are who they say they are. Only the third-party authentication service has access to the physician’s private information; the software vendor does not.

“They know everything about your identity,” Schade says. “They have more information than the credit bureau has. It’s scary.”

It took Schade about a week to complete the authentication process, which included answering detailed questions about his credit history.

“It’s not something you can do in a day,’ he says. “It’s fairly rigorous.”

Once DrFirst verified his identity, Schade had to create two identifiers to use whenever he prescribes a controlled substance electronically. An identifier can be a password, a fingerprint, a retinal scan, or a token. Schade uses a hard token and a password.

A hard token is a pocket-sized electronic device. When physicians want to verify their identity, they push a button on the token that generates a number the physician enters into an e-prescription form within a short time frame, usually 30 seconds to a minute. A soft token works similarly but takes the form of a smartphone app.

After the vendor sent him a hard token, Schade says he wanted to give the process a trial run. He called 20 pharmacies near his office to see which ones could fill an electronic prescription for a controlled substance. He says half of the pharmacists flat-out refused his EPCS request.

Of the pharmacies with EPCS-certified software systems, only 25 percent had actually filled a prescription of this kind, Schade says. Walgreens and H-E-B Pharmacy are two chains that accept EPCS. Schade says physicians’ best bet is to call their local pharmacies and ask whether they have EPCS-certified software.

Individual pharmacists also may decide not to fill any prescription they choose. Schade says only one pharmacist of the initial 20 was willing to fill an electronic request for a schedule II controlled substance.

Pharmacy perspective

On March 1, after completing a small pilot program with a select group of physicians and pharmacists, DPS released guidelines to aid accurate reporting of EPCS to the Texas Prescription Monitoring Program, which the Texas Legislature created in 1982 to track schedule II prescriptions. The law requires pharmacists to report schedule II prescriptions to the monitoring program within seven days of filling the prescription.

According to the guides, physicians using EPCS should take the following three steps to save time and improve security and patient safety:

1. Confirm with your e-prescribing software vendor that the software application is EPCS-certified per DEA requirements. Physicians can check health information network Surescripts’ website.
2. Confirm your software vendor has notified Surescripts that both the software and the prescriber have been certified and are eligible to transmit schedule II through V electronic prescriptions. If Surescripts is not notified, the transaction will be blocked before it reaches the pharmacy.
3. Understand that not all pharmacies are certified to accept EPCS transactions. This may result in the prescription being returned when a doctor attempts to transmit it electronically.

TMA is offering a free continuing medical education course on risk evaluation and mitigation strategies specifically for physicians who prescribe schedule II controlled substances. The three-hour course is presented by the Florida Medical Association.

Many pharmacists are reasonably skeptical about filling e-prescriptions for schedule II controlled substances. In June 2013, Walgreens entered into an $80 million settlement with the DEA after the agency charged Walgreens with failing to properly account for the sale of many narcotic painkillers. Walgreens has since changed its policy to require pharmacists to take additional steps to verify the identity of the prescribing physician when many controlled substances are involved.

Though Walgreens’ case was not specific to e-prescribing, pharmacist Dennis Wiesner, senior director of government affairs, privacy, and pharmacy for H-E-B, says the DEA’s recent crackdown on pharmacies has left many pharmacists second-guessing themselves when filling narcotic prescriptions.

“You just become a little bit more cautious,” he says.

Wiesner says H-E-B, which installed EPCS software in its 240 Texas pharmacies more than a year ago, trains its pharmacists to look for red flags. He says the red flags apply to electronic and paper prescriptions and include:

• Questionable drug combinations and quantities;
• The physical distance between the prescribing physician’s office and the pharmacy, distance between the prescribing physician and the patient’s home address, and distance between the patient and the pharmacy; and
• Cash payment.

Wiesner says if a patient asks him to fill 200 or more tablets of hydrocodone, or a combination of a popular “drug cocktail” such as hydrocodone, carisoprodol, and alprazolam, he will take further action to confirm the prescription. And if a patient has traveled a long distance to the pharmacy, it could be a sign that other pharmacies refused to fill the prescription.

When pharmacists encounter one of these red flags, they can call the prescribing physician to confirm the medication or search the patient’s DPS profile to look for signs of drug abuse.

Wiesner says prescription fraud also is a huge problem.

“Pharmacies encounter that every single day,” he says.

In these cases, he says, someone pretending to be a physician or office staff member calls the prescription in to the pharmacy outside normal business hours, or a patient brings in a paper prescription written on a stolen or duplicated prescription pad.

Pharmacists who fill these often see a surge in similar prescription requests either the same day or in the days immediately following, Wiesner says.

He says hydrocodone is high on the list of controlled substances that people try to obtain illegally.

“We trust pharmacists to use professional judgment,” he says. “I think our folks tend to err on the side of the patient when they can.”

Wiesner says EPCS is the most efficient way for physicians and pharmacists to keep controlled substances from people who would abuse them.

“It’s the safest route, 100 percent,” he says.

Wiesner says when a physician sends an EPCS to H-E-B, the prescription must pass through Surescripts, an intermediary that looks at multiple data, including the drug in question. Surescripts also checks to see if the prescribing physician’s EPCS software is DEA-certified. If it is, the prescription is sent to an H-E-B pharmacy for processing. If a physician’s EPCS system is not certified, Surescripts will push the prescription request back to the physician, instead of forwarding the request to the pharmacy.

Even with EPCS, Wiesner says, physicians should continue to expect calls from pharmacists who want to clarify and authenticate prescription dosages, directions, or drug interaction details. But ultimately, EPCS will help prevent prescription abuse and protect both pharmacists and physicians, he says.

Staying Vigilant

Given White’s ordeal, she says e-prescribing is the safer route for physicians who want to avoid prescription fraud.

“But it’s going to be a lot more work,” she says. “It’s just so embryonic at this point.”

White says she believes EPCS will get easier, but in the meantime, physicians must be vigilant by getting to know their local pharmacists and checking their DPS profiles and their patients’ profiles for signs of prescription fraud.

She says physicians who refuse to participate in EPCS and continue to prescribe controlled substances using a paper system should check their DPS profiles even more frequently.

Physicians must write all schedule II prescriptions on an official DPS prescription pad. A pad of 100 forms costs $9. Physicians can obtain schedule II prescription pads from DPS by faxing (512) 424-5380.

“I have also instituted an office policy that does not allow office staff to call in any controlled substances,” White says. “I usually check my own profile on a monthly basis, but I overlooked it for one month. During that time: BAM!”

Physicians can check their patients’ and their own profiles on the DPS prescription access website.

White says while it is a necessary resource, the DPS website is difficult to use. For example, only physicians, registered nurses, physician assistants, or licensed vocational nurses have access to the site. Other office personnel, even those with access to HIPAA-sensitive information, can’t access the site.

“This translates into considerable time required to perform appropriate searches on individuals attempting to procure prescriptions for controlled substances,” White says. “In addition, the website has the ability to track physician prescribing trends, so why can it not notify a physician in the event of activity on their profile, say by e-mail?”

Schade says EPCS is still a new practice, and it will take time to get more pharmacies to install or update software to be EPCS-certified.

“This is in its infancy. We expect there will be problems. Nothing just takes off,” he says.

He predicts it will take two to five years for EPCS to become a convenient way for physicians to safely prescribe medications.

“The world is moving forward. The technology is moving forward,” he says. “I have faith that e-prescribing will eventually become the standard of care.”

This article was originally published in Texas Medicine [Tex Med. 2014;110(7):55-59.] It is republished here with permission.